89cb50d7ef8764e6651f530632d972d9003683f06b28ac58be4048996ebe5c83

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe
Size

197KB
MD5

824b3bd8c222fcdbc3e533c9c859236f
SHA1

6d8373ce4735a22ad1cf27660f01776c3624a48d
SHA256

89cb50d7ef8764e6651f530632d972d9003683f06b28ac58be4048996ebe5c83
SHA512

e0de70d5ac1e7528e3c5bb2eab13f21ed90f340ad32aa7f89a535655430aaaaf232923d6519fa741115d550c73569f2b74e06365e48f158f17086762799e17a1
SSDEEP

3072:jEGh0oSl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGwlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x000600000002320b-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000023213-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000023213-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023219-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023213-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002177b-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002177d-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d00000002177b-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070d-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006e1-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}	{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}\stubpath = "C:\\Windows\\{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe"	{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24BFFEC8-4466-46b2-B00F-59A1B912E152}\stubpath = "C:\\Windows\\{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe"	{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}\stubpath = "C:\\Windows\\{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe"	{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24805002-2D62-4a5b-830C-4FBEB5E749AE}	{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7EF2256-4733-499a-8ECE-0B0A017BE97B}\stubpath = "C:\\Windows\\{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe"	{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24805002-2D62-4a5b-830C-4FBEB5E749AE}\stubpath = "C:\\Windows\\{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe"	{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B25B987-64FE-4d0b-BA42-232FC11A2E61}	2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}\stubpath = "C:\\Windows\\{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe"	{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6607C6B6-4096-47b7-A714-7C54F01B5E21}	{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BB23ED7-80B6-4483-9018-F568C0AA2067}\stubpath = "C:\\Windows\\{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe"	{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB7F518C-A8E2-4c47-8407-58555E239EC5}	{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7EF2256-4733-499a-8ECE-0B0A017BE97B}	{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBB15087-C350-4b64-BB82-D03FA051592F}	{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBB15087-C350-4b64-BB82-D03FA051592F}\stubpath = "C:\\Windows\\{CBB15087-C350-4b64-BB82-D03FA051592F}.exe"	{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEC1E84E-4CE4-40ac-949E-A6E673D36DF7}\stubpath = "C:\\Windows\\{BEC1E84E-4CE4-40ac-949E-A6E673D36DF7}.exe"	{CBB15087-C350-4b64-BB82-D03FA051592F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B25B987-64FE-4d0b-BA42-232FC11A2E61}\stubpath = "C:\\Windows\\{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe"	2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6607C6B6-4096-47b7-A714-7C54F01B5E21}\stubpath = "C:\\Windows\\{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe"	{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24BFFEC8-4466-46b2-B00F-59A1B912E152}	{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB7F518C-A8E2-4c47-8407-58555E239EC5}\stubpath = "C:\\Windows\\{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe"	{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEC1E84E-4CE4-40ac-949E-A6E673D36DF7}	{CBB15087-C350-4b64-BB82-D03FA051592F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}	{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BB23ED7-80B6-4483-9018-F568C0AA2067}	{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}	{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe

Executes dropped EXE 12 IoCs

pid	Process
3100	{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe
3728	{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe
228	{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe
2420	{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe
4608	{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe
3976	{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe
4236	{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe
1848	{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe
1804	{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe
1136	{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe
3196	{CBB15087-C350-4b64-BB82-D03FA051592F}.exe
1376	{BEC1E84E-4CE4-40ac-949E-A6E673D36DF7}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe	{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe
File created	C:\Windows\{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe	{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe
File created	C:\Windows\{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe	{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe
File created	C:\Windows\{CBB15087-C350-4b64-BB82-D03FA051592F}.exe	{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe
File created	C:\Windows\{BEC1E84E-4CE4-40ac-949E-A6E673D36DF7}.exe	{CBB15087-C350-4b64-BB82-D03FA051592F}.exe
File created	C:\Windows\{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe	2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe
File created	C:\Windows\{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe	{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe
File created	C:\Windows\{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe	{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe
File created	C:\Windows\{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe	{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe
File created	C:\Windows\{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe	{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe
File created	C:\Windows\{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe	{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe
File created	C:\Windows\{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe	{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1684	2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3100	{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe
Token: SeIncBasePriorityPrivilege	3728	{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe
Token: SeIncBasePriorityPrivilege	228	{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe
Token: SeIncBasePriorityPrivilege	2420	{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe
Token: SeIncBasePriorityPrivilege	4608	{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe
Token: SeIncBasePriorityPrivilege	3976	{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe
Token: SeIncBasePriorityPrivilege	4236	{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe
Token: SeIncBasePriorityPrivilege	1848	{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe
Token: SeIncBasePriorityPrivilege	1804	{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe
Token: SeIncBasePriorityPrivilege	1136	{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe
Token: SeIncBasePriorityPrivilege	3196	{CBB15087-C350-4b64-BB82-D03FA051592F}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 3100	1684	2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe	88
PID 1684 wrote to memory of 3100	1684	2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe	88
PID 1684 wrote to memory of 3100	1684	2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe	88
PID 1684 wrote to memory of 2912	1684	2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe	89
PID 1684 wrote to memory of 2912	1684	2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe	89
PID 1684 wrote to memory of 2912	1684	2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe	89
PID 3100 wrote to memory of 3728	3100	{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe	92
PID 3100 wrote to memory of 3728	3100	{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe	92
PID 3100 wrote to memory of 3728	3100	{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe	92
PID 3100 wrote to memory of 4604	3100	{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe	93
PID 3100 wrote to memory of 4604	3100	{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe	93
PID 3100 wrote to memory of 4604	3100	{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe	93
PID 3728 wrote to memory of 228	3728	{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe	96
PID 3728 wrote to memory of 228	3728	{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe	96
PID 3728 wrote to memory of 228	3728	{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe	96
PID 3728 wrote to memory of 2552	3728	{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe	95
PID 3728 wrote to memory of 2552	3728	{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe	95
PID 3728 wrote to memory of 2552	3728	{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe	95
PID 228 wrote to memory of 2420	228	{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe	97
PID 228 wrote to memory of 2420	228	{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe	97
PID 228 wrote to memory of 2420	228	{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe	97
PID 228 wrote to memory of 2588	228	{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe	98
PID 228 wrote to memory of 2588	228	{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe	98
PID 228 wrote to memory of 2588	228	{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe	98
PID 2420 wrote to memory of 4608	2420	{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe	99
PID 2420 wrote to memory of 4608	2420	{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe	99
PID 2420 wrote to memory of 4608	2420	{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe	99
PID 2420 wrote to memory of 5024	2420	{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe	100
PID 2420 wrote to memory of 5024	2420	{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe	100
PID 2420 wrote to memory of 5024	2420	{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe	100
PID 4608 wrote to memory of 3976	4608	{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe	101
PID 4608 wrote to memory of 3976	4608	{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe	101
PID 4608 wrote to memory of 3976	4608	{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe	101
PID 4608 wrote to memory of 1812	4608	{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe	102
PID 4608 wrote to memory of 1812	4608	{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe	102
PID 4608 wrote to memory of 1812	4608	{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe	102
PID 3976 wrote to memory of 4236	3976	{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe	103
PID 3976 wrote to memory of 4236	3976	{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe	103
PID 3976 wrote to memory of 4236	3976	{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe	103
PID 3976 wrote to memory of 4752	3976	{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe	104
PID 3976 wrote to memory of 4752	3976	{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe	104
PID 3976 wrote to memory of 4752	3976	{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe	104
PID 4236 wrote to memory of 1848	4236	{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe	105
PID 4236 wrote to memory of 1848	4236	{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe	105
PID 4236 wrote to memory of 1848	4236	{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe	105
PID 4236 wrote to memory of 1972	4236	{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe	106
PID 4236 wrote to memory of 1972	4236	{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe	106
PID 4236 wrote to memory of 1972	4236	{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe	106
PID 1848 wrote to memory of 1804	1848	{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe	107
PID 1848 wrote to memory of 1804	1848	{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe	107
PID 1848 wrote to memory of 1804	1848	{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe	107
PID 1848 wrote to memory of 632	1848	{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe	108
PID 1848 wrote to memory of 632	1848	{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe	108
PID 1848 wrote to memory of 632	1848	{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe	108
PID 1804 wrote to memory of 1136	1804	{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe	109
PID 1804 wrote to memory of 1136	1804	{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe	109
PID 1804 wrote to memory of 1136	1804	{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe	109
PID 1804 wrote to memory of 1176	1804	{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe	110
PID 1804 wrote to memory of 1176	1804	{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe	110
PID 1804 wrote to memory of 1176	1804	{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe	110
PID 1136 wrote to memory of 3196	1136	{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe	111
PID 1136 wrote to memory of 3196	1136	{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe	111
PID 1136 wrote to memory of 3196	1136	{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe	111
PID 1136 wrote to memory of 3416	1136	{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe	112

C:\Users\Admin\AppData\Local\Temp\2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_824b3bd8c222fcdbc3e533c9c859236f_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe
  C:\Windows\{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe
    C:\Windows\{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BEBC3~1.EXE > nul
      4⤵
      PID:2552
  - - C:\Windows\{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe
      C:\Windows\{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Windows\{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe
        
        C:\Windows\{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2420
      - C:\Windows\{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe
        
        C:\Windows\{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe
        
        C:\Windows\{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe
        
        C:\Windows\{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe
        
        C:\Windows\{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe
        
        C:\Windows\{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe
        
        C:\Windows\{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\{CBB15087-C350-4b64-BB82-D03FA051592F}.exe
        
        C:\Windows\{CBB15087-C350-4b64-BB82-D03FA051592F}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
        
        C:\Windows\{BEC1E84E-4CE4-40ac-949E-A6E673D36DF7}.exe
        
        C:\Windows\{BEC1E84E-4CE4-40ac-949E-A6E673D36DF7}.exe
        13⤵
        Executes dropped EXE
        
        PID:1376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CBB15~1.EXE > nul
        13⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{24805~1.EXE > nul
        12⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7781B~1.EXE > nul
        11⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B7EF2~1.EXE > nul
        10⤵
        
        PID:632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EB7F5~1.EXE > nul
        9⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{24BFF~1.EXE > nul
        8⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1BB23~1.EXE > nul
        7⤵
        
        PID:1812
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F8C71~1.EXE > nul
        6⤵
        
        PID:5024
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6607C~1.EXE > nul
        5⤵
        
        PID:2588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8B25B~1.EXE > nul
    3⤵
    PID:4604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1BB23ED7-80B6-4483-9018-F568C0AA2067}.exe

Filesize
197KB

MD5
c6abcf06fcdf709eddcb841b15b725e5

SHA1
005731901d199543099210f314ebef1719a5765b

SHA256
58c5cc6a927916b68cb6880b761eeecc92b9b767dde7d3aa0340d365754e444b

SHA512
0fd70e873cef028a0fb3db56fe298853da9f2daf2678a7fab84981dbf29ec1be917df98290d1e2bac7d89e569a30d576b7d141017a4a7ecd08946496093a8115

Download Submit
C:\Windows\{24805002-2D62-4a5b-830C-4FBEB5E749AE}.exe

Filesize
197KB

MD5
016ef391dbbb2d85796f3befa78eee39

SHA1
98479afdc89813ede552f07e1282019450c1bf69

SHA256
6fec6e94ecede028c6548cc987ffb5a05d93da33866d37425e3e16bd63b55991

SHA512
1c92b9400e5e186c762b2d9d92191c2fba661ba6be98b468d523cd812765ee973a84370870fe444b625137f1fe935ad0ce6b12999b3a3075c73afbf4fc1795bb

Download Submit
C:\Windows\{24BFFEC8-4466-46b2-B00F-59A1B912E152}.exe

Filesize
197KB

MD5
ab24b5c891a6aec81b4458981b16d35f

SHA1
03941288618048049a8c99158763b2ff562dad2b

SHA256
3a65c68405156b703468e04824ce1f51dbef5f930e8ff2720b8a16ea3a8dbce7

SHA512
8d0f5fbd8e58c258c0a8b2fab9bc3d973041dc5e58f01e9e0c0553a01ed9c1ecb6238a74a021bf57ac4cd1d846f6e87df18a3ad36ac52b9acb7fbe3096e4e819

Download Submit
C:\Windows\{6607C6B6-4096-47b7-A714-7C54F01B5E21}.exe

Filesize
197KB

MD5
2f491bac716a95e8290945a5f9ae9dfa

SHA1
7b27e23bcec0ee4ee2b382c429b4c3a8e6cf3163

SHA256
d5af525fefeaf921750c9581654838322aa03e95223664deacb6d8a638fc9fd8

SHA512
9020a27648b6bd09d9ed94e7650f28d203ee03a4b55b8eab6b9267fa31b9aa54dbfdde83309fd574448f61daf2b1630dc7a7282dd800dbe660f102fd087bb3da

Download Submit
C:\Windows\{7781B390-5A74-4c43-AE02-EF4BA64BF6E7}.exe

Filesize
197KB

MD5
a2a8a46fe4cfb3d772fee09157253dcf

SHA1
84dfe13f5f12376895da8135ab103e842aabd848

SHA256
6a14a711f852e21d15cc35b962b76df0be15e550ba14d11744ba254a981e0674

SHA512
ba3c12d64508a7ade8fecab91cbd7f161124059f813d964e7779bf28fbf2fdbed1c19e426d70f70495fdb2fc57311ccef285248ab39b0cbc685a0c045d26154d

Download Submit
C:\Windows\{8B25B987-64FE-4d0b-BA42-232FC11A2E61}.exe

Filesize
197KB

MD5
32de64b2b0c9365f3e51a013be8edf23

SHA1
12c290c7c3f15406d810d533fd197f61bfb5e4c6

SHA256
522fb65fbba455675d4df3a8e3f62d9dd1845b8e3591f160560558436812765b

SHA512
2fae93a24205fd1697af043cc8b820ee41c92570f2e97558072f5de787fcd94426565718613261737dd824c2c76bc09649732dfe10e7a6cd1e60a36c4245aead

Download Submit
C:\Windows\{B7EF2256-4733-499a-8ECE-0B0A017BE97B}.exe

Filesize
197KB

MD5
11d7c1517034e1c02dda0cac9b05ac93

SHA1
6beb92ef86dc43a7ee1321c4265471d76614f14f

SHA256
c64dee90aa60ccd3d9ed0c0deb5a73a09eaa612afa83f0a4f9fae90d5acb431c

SHA512
c5f23d832fd2411180614645783d1db192b20d3dfdc4636d7fdc8bc86e52d50d16d2a20a6f82d76e16911c5e1aecc7f53d0e11693b8fd3261152cb7db09afcdf

Download Submit
C:\Windows\{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe

Filesize
197KB

MD5
ee488f777d9dbe7ff3b2a0e606125538

SHA1
4f8e8fe62caa13f0e3d360ae3256f32f512bc158

SHA256
13db288d0bb2db1a941fddc7615f12387dfeed4bbbdcc59b002cf398af03a045

SHA512
4f0a0073d30f031413faa16e2219500b9997fe7da657e98a5f5491877a9971b3ed95bc25403d5be4c6b758474b166c64a5b5aed91a6f4a67858735fb972f76d9

Download Submit
C:\Windows\{BEBC3EB2-7FB8-4488-9C43-A7936241BB2C}.exe

Filesize
85KB

MD5
ecbaca191d2788ec24786580480fa2e4

SHA1
e04788a0060a106cdf65efc2242ce79bb175b329

SHA256
2bb52cc861090be5741056cab1ca97798530f95c055188dde05ca3a3aef5e45b

SHA512
723f9b242ff2badc910d3916ab3a0ae7e82bff604e31bb37e9cfd51f6a1966876648af6fd83ae2803cb7f3a13ba5402fd9f208535dc0ec49f394a2ccf4f44cc7

Download Submit
C:\Windows\{BEC1E84E-4CE4-40ac-949E-A6E673D36DF7}.exe

Filesize
197KB

MD5
3317b8d406c6611c1ce81517e712a8a1

SHA1
28c9ddda4b040b70ec88efa83eecd8fbcb530aae

SHA256
cfc234ff48b13cf93879f9c7ef911ee867728817bc8aa69022ce8ae295af0546

SHA512
0cad6d1556fb4dd5e7dce0e23297fe066d6045cbd257e342c5c358099ac9dbbebe26fd1cf8cccf152fbe2b86c40201bee12d10976a24c0c5db1eb76dc362e4b4

Download Submit
C:\Windows\{CBB15087-C350-4b64-BB82-D03FA051592F}.exe

Filesize
197KB

MD5
d617c074064eb26675972aaa670eae1d

SHA1
4410a916f22ef1ef7def3ea997f24bc4300b9227

SHA256
4307d809a85861e955083d3a2a938c6a3046187f7b03d505e974d40bb481e936

SHA512
46bcfbea2f8471868a6089e46875e613b1011c2f203e13c9a5d7fd11d3064cf30d88c78786c262f972adda1e5120d057f7e95d7a5f3e64c1eaff28f4a40f073b

Download Submit
C:\Windows\{EB7F518C-A8E2-4c47-8407-58555E239EC5}.exe

Filesize
197KB

MD5
522a590d4c923dfe1fe3e72487a99c3a

SHA1
386e4610851c5e5263b0b152e20cd6e0e4aad514

SHA256
986c8da0ca9b9e5c81ef3bfd6def163a866049e9465bda5ea1511db78dac0829

SHA512
2cf32fc7d634fe7c26b07982806bfca83b0e0dccfc641906f3673187b166b5109b932b66da39441b03b511d7f6acbc9e5df8a98eef58e6e23e6fdee141339946

Download Submit
C:\Windows\{F8C71CB3-28AD-4a20-94F4-9DD5BC35E74F}.exe

Filesize
197KB

MD5
0ae091dd87118fe7fe4741c9bf447d11

SHA1
a95b6bcdf5a928963a4f7d28255dc4d509a132b0

SHA256
6314c04296ffdb0dcae4aebec92df236e46b92286e8f8597ddb7a46176d15b19

SHA512
ad46cecbc3a9f849c8c82ed74921b3a380bb99b4eca46237c16609eba764a2b46d4dd303645f968fc67e0afa15163c2bff1a948bd72b2979343e074b8c7420c9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads